HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsCredentialsHealth (basic)PIIMediumContained

Kerkering, Barberio & Co., Certified Public Accountants

bd_fb5c88001a862006 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 27, 2025

Filed

Mar 12, 2026

To disclose

41 weeks

Affected

4state residents only

Linked

3 filings

Confidence

67%

Full breach record for Kerkering, Barberio & Co., Certified Public Accountants →

Kerkering, Barberio & Co., a CPA firm, discovered unauthorized access to four email accounts on May 27, 2025. An external actor accessed files containing sensitive personal information, including SSNs, financial account details, and health data. The firm isolated accounts, engaged forensic investigators, and confirmed data exfiltration. Four New Hampshire residents were affected. Notifications were sent on March 13, 2026, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 41 weeks / 289 days

May 27, 2025

Discovered

Mar 12, 2026

Filed

vs. sector median

+23 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_87bdbb24481860602026-03-13 · +1dCandidate
Nebraska State AGbd_f12034b394a33d472026-03-13 · +1dVerified

Name: Kerkering, Barberio & Co., Certified Public Accountants
norm: kerkering barberio co certified public accountants
Domain: wilsonelser.com

Name: Kerkering, Barberio & Co., Certified Public Accountants
norm: kerkering barberio co certified public accountants
Industry: Professional Servicesllm

Discovered: May 27, 2025
Materiality determined: —
Notification sent: Mar 13, 2026
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDFinancial accountFinancial credentialsCredentialsHealth (basic)PII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email CollectionT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Isolated the affected email accounts
Engaged a specialized third-party cybersecurity firm to assist with securing the email accounts
Conducted a comprehensive forensic investigation to determine the nature and scope of the incident
Engaged a third-party data mining vendor to conduct a comprehensive review of the potentially accessed data
Engaged a third-party notification vendor to assist with notifying the affected individuals
Disconnected all access to the impacted email accounts
Changed administrative credentials
Restored operations in a safe and secure mode
Enhanced the security measures
Offered 12 months of complimentary credit monitoring and identity theft restoration services through Cyberscout
Changes made: Enhanced the security measures
Took steps and will continue to take steps to mitigate the risk of future harm
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(289 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGMar 12 · first · this page

Maine State AG+1d

Nebraska State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/kerkering-barberio-certified-public-accountants-20260312.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 12, 2026
Raw hash: f2effb05f820a105d806108674d7c53ad32c811c31f6c914639b915a5eab094f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityKerkering, Barberio & Co., Certified Public Accountants

Victim entityKerkering, Barberio & Co., Certified Public Accountants

Incidentdiscovered May 27, 2025

Stated responseIsolated the affected email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov